CVE-2026-115973

FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery

View on CVE.org
Published Oct 24, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.

Analysis

AI-generated

Technical impact

A flaw in the password‑recovery routine of FaveoHelpDesk 2.0.3 allows an attacker to trigger a weak reset process via the ForgotPasswordController::sendResetLinkEmail method. The weakness results in a reset path that is not sufficiently protected, enabling unauthorized password resets and potential account takeover. The vulnerability is a classic case of poor password‑reset policy (CWE‑640).

Affected Systems

The affected product is FaveoSuite Faveo Helpdesk version 2.0.3. No other versions or vendors are listed. Administrators should verify that the instance is running this specific version and take action accordingly.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, so current exploitation probability is unknown. The issue is not in the CISA KEV catalog. The flaw can be triggered remotely through the password‑reset functionality exposed by the web application. Given the remote vector and moderate score, attackers with an awareness of the web interface could abuse the weak reset to gain account access.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑released patch that fixes the weak password recovery in FaveoHelpDesk 2.0.3.
  • If the patch is not yet released, temporarily disable or restrict the password‑reset functionality and enforce strong password policies.
  • Enable multi‑factor authentication for all user accounts to mitigate potential account takeover and monitor for unusual password‑reset activity.

Generated by OpenCVE AI on October 24, 2026 at 19:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Faveosuite faveo-helpdesk
Vendors & Products Faveosuite faveo-helpdesk
Type Values Removed Values Added
Description A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure.
Title FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery
First Time appeared Faveosuite
Faveosuite faveo Helpdesk
Weaknesses CWE-640
CPEs cpe:2.3:a:faveosuite:faveo_helpdesk:*:*:*:*:*:*:*:*
Vendors & Products Faveosuite
Faveosuite faveo Helpdesk
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-640

    Weak Password Recovery Mechanism for Forgotten Password

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 29, 2026, 3:25 PM
Reserved
Oct 24, 2026, 12:52 AM

View source JSON

Updated
Oct 29, 2026, 3:25 PM

JSON

Status
Deferred
Published
Oct 24, 2026, 7:17 PM
Modified
Oct 29, 2026, 4:17 PM

View source JSON

No data.

Updated
Oct 24, 2026, 7:45 PM

JSON